CVE-2024-6281 — Path Traversal in Lollms

CWE-22 — Path TraversalCWE-440 — Expected Behavior Violation3 documents3 sources
Severity
7.3HIGHNVD
EPSS
0.1%
top 76.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Parisneo LollmsLollms
Timeline
PublishedJul 20

Description

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 2.5 | Impact: 4.7

Affected Packages2 packages

▶CVEListV5parisneo/parisneo_lollmsunspecified — 9.5.1
▶PyPIlollms/lollms< 9.5.1

🔴Vulnerability Details

2
GHSA
LoLLMS vulnerable to Expected Behavior Violation↗2024-07-20
▶
OSV
LoLLMS vulnerable to Expected Behavior Violation↗2024-07-20
▶